Why the provider matters more than the cameras
Cameras have become a commodity. Most reputable hardware now ships with sharp low-light imaging, cellular connectivity, and onboard analytics, which means the real difference between vendors is what happens after a camera detects something. That work is done by people, and the quality of those people and their process is what you are actually buying.
The false alarm problem shows why. Research compiled by the Urban Institute found that false alarms account for 10–25% of all police calls for service in many jurisdictions. Police departments know this, and many now deprioritize unverified alarm calls or charge fines for repeat false dispatches. A monitoring provider that forwards every motion event without human verification is not protecting your site; it is burning your credibility with local responders.
Meanwhile, the threat side is not standing still. The FERC 2025 Summer Assessment reported that the Western Interconnection recorded 220 physical security incidents in 2024, more than double the 107 recorded in 2023. Remote, unstaffed assets are being targeted more often, and when no one is on site, the speed and quality of remote verification is the whole game.
Where are the operators, and who employs them?
Start with geography and employment structure, because everything downstream depends on it. Ask three questions directly: Are your operators US-based or offshore? Are they direct employees or subcontracted through a third-party monitoring wholesaler? Can I tour your monitoring floor, in person or by video call?
None of these answers is automatically disqualifying, but each carries tradeoffs you should understand. Offshore operations can struggle with local context, such as knowing that a figure crossing a laydown yard at 2 a.m. is not a second-shift employee, and with clear communication to US police dispatchers under pressure. Subcontracted monitoring means the company selling you the service does not control training, staffing levels, or quality assurance for the people actually watching your cameras.
Then dig into staffing. Ask how many operators are on the floor overnight, what the operator-to-site ratio looks like during peak alarm hours, and what happens during alarm storms, such as a windy night that triggers hundreds of motion events across their customer base. Ask about operator training, certification, and annual turnover. High turnover on the monitoring floor is one of the most reliable predictors of missed incidents, because judgment about what is normal on your site takes time to build.
A provider running a genuine security operations center will answer these questions readily and usually offer the tour before you ask. A call center reselling white-labeled monitoring will get vague. Vagueness is your answer.
How does verification actually work?
Verification is the step where analytics-flagged events get a trained human's eyes before anyone is called. Ask each candidate to walk you through the pipeline for one real event: what the analytics detect, what the operator sees, what they check before declaring an incident, and how the whole sequence is logged.
Two follow-up questions matter most. First, is monitoring event-based or continuous live watching? Each model fits different sites and budgets, and the tradeoffs are covered in our guide to event-based versus live video monitoring. A provider should be able to explain which model they are quoting you and why it fits your site, not just default to whichever is cheaper to staff.
Second, and this is the question that exposes the most vendors: what is your measured average time from alert to human verification, and how do you measure it? Do not accept a marketing number. Ask whether it is measured across all customers or a favorable subset, whether it appears in your monthly reporting, and whether they will commit to it in the contract. For a picture of what a genuinely fast verification pipeline looks like end to end, see our breakdown of the 60-second SOC. The point of that article is not that every provider must hit a specific number; it is that a serious provider knows its number, measures it honestly, and shows it to customers.
What happens after an incident is verified?
Escalation is where monitoring converts into outcomes, and it is where providers differ most. The provider's job is not to be your entire security program. It is to route verified incidents to the right responders, so people, yours or your security partner's, handle situations that have actually been confirmed. A good SOC makes an on-site guard team dramatically more effective by sending them to verified events instead of noise, which is why guard firms are often monitoring providers' closest collaborators. We cover how the two work together in remote video monitoring versus security guards.
Ask candidates to show you a real escalation protocol document. It should specify, in order: intervention tools available to the operator, such as live audio warnings through on-site speakers; the contact tree, with named roles and backup contacts; criteria for calling police, and how the operator presents verified video evidence to dispatch; and what happens when a contact does not answer. Verified video changes the police conversation entirely. An operator who can tell dispatch "I am watching two people load copper into a white pickup right now" gets a very different response than an automated alarm signal, which is exactly the credibility the false alarm statistics above show most alarm calls have squandered.
Also ask who writes the protocol. If the answer is a template you fill out yourself with no review, expect trouble during your first real incident. Strong providers run a structured onboarding where they learn your site, your after-hours patterns, and your response resources, then rehearse the escalation with your contacts.
How is evidence packaged and delivered?
Incidents do not end when the trespasser leaves. Insurance claims, police reports, prosecution, and internal reviews all depend on what the provider hands you afterward, so ask to see a sample incident report before you sign.
A complete evidence package includes timestamped video clips covering the full event, not just the triggering frames; an operator-written narrative of what was observed and what actions were taken, with times; the escalation log showing who was contacted, when, and what they said; and export in formats that law enforcement and insurers accept without special software. Ask how quickly a package is delivered after an incident and whether there is a per-request fee. Our guide to the security camera incident reporting workflow details what each element should contain and why chain-of-custody discipline matters if footage ever reaches a courtroom.
Retention terms belong in this conversation too. Ask how long footage is kept by default, whether incident footage is preserved beyond the standard window automatically, and what happens to your archive if you leave. Get the answer in writing.
Who watches the cameras themselves?
A monitoring service is only as good as the cameras feeding it, and cameras fail quietly: a spider web across a lens, a failed cellular modem, a solar charging fault, a view knocked out of alignment by wind. Ask every candidate how they monitor camera health, how quickly a dead or degraded camera is detected, and who is responsible for fixing it.
The answers you want: automated health checks that flag offline cameras, obstructed views, and power or connectivity degradation; proactive notification to you, rather than discovery during an incident; defined responsibility for maintenance, including whether truck rolls are included or billed; and connectivity failover with onboard recording so an outage does not mean a gap. A provider that cannot tell you their current camera uptime across their fleet is not measuring it, and if they are not measuring it, some fraction of the cameras they bill for are dark right now.
Contract terms and the full vetting checklist
Before you compare pricing, compare accountability. The table below condenses the questions from this guide into a checklist you can bring to every sales call.
| Question to ask | Why it matters | Red flag answer |
|---|---|---|
| Where are your operators, and who employs them? | Controls training, quality, and communication with US dispatchers | Vague, or "we partner with a monitoring center" |
| Can I tour the SOC? | Verifies the operation exists as described | Refusal or repeated delays |
| What is your measured average time-to-verify? | Speed of human verification drives outcomes | A number with no methodology, or no number |
| Event-based or live monitoring, and why for my site? | Model should fit the site, not the vendor's staffing | One-size-fits-all answer |
| Show me your escalation protocol template | Determines what happens during real incidents | Self-serve template with no rehearsal |
| Show me a sample incident evidence package | Insurance and prosecution depend on it | Raw clips only, no narrative or log |
| How do you monitor camera health, and who fixes failures? | Dark cameras mean unmonitored gaps | Customer is responsible for noticing outages |
| What are the term, auto-renewal, and exit provisions? | Long lock-ins shift risk onto you | Multi-year lock-in with auto-renewal and footage forfeiture |
On the contract itself, look closely at term length and renewal mechanics. Month-to-month or short initial terms signal a provider that expects to earn the renewal on performance. Confirm in writing who owns your footage, what reporting you receive monthly, which service commitments are contractual rather than aspirational, and what transition support you get if you leave. Any provider that resists putting its verbal claims into the agreement has told you how much those claims were worth.
Putting the checklist to work
Run at least two or three providers through these questions side by side, and weight the answers about people and process over the answers about hardware. The pattern to watch for is simple: real SOCs answer with specifics, documents, and measured numbers, while call centers answer with adjectives.
At Vision Detection Systems, we built our remote video monitoring operation around the standards in this guide: US-based operators verifying every alert, documented escalation protocols built with each customer, evidence packages designed for police and insurers, and continuous health monitoring across our solar-powered surveillance units. We publish this checklist because we are comfortable being measured against it, and we would encourage you to hold every provider you evaluate, including us, to the same questions.